Africa Compute Fund

Africa Compute Fund ("ACF", "we", "us", or "our") operates websites, applications, AI and compute services, APIs, integrations, communications, and related digital services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, retain, protect, and otherwise process personal data when you use the Services or interact with us.

This Policy is intended to provide a clear, practical description of our data practices. It does not treat consent as the legal basis for every use of personal data. Where consent is required by law or by a specific integration, we request it separately. Service-specific notices, contracts, data processing agreements, or in-product disclosures may provide additional information and will apply alongside this Policy.

1. Who We Are and Our Role

ACF is a Kenya-based technology operator. Depending on the context, we may act as a data controller, data processor, service provider, or contractor.

When we decide why and how personal data is processed, such as for account administration, security, billing, product operations, direct support, or our own website analytics, we generally act as a controller.
When a business customer uses our Services to process information about its own customers, employees, suppliers, or users, that business may be the controller and ACF may process the data on its instructions. In that case, the business customer is responsible for its own notices, permissions, and lawful basis, and our processing may also be governed by a data processing agreement or other contract.

If you interact with a business that uses our Services, privacy requests about data controlled by that business may need to be directed to the business first. We will assist our customers where required by law or contract.

2. Personal Data We Collect

Account and identity data

We may collect your name, email address, phone number, organization, role, login provider identifiers, account IDs, authentication records, session information, account settings, and other information needed to create and secure an account.

Organization and business profile data

We may collect business names, categories, descriptions, contact details, addresses or service areas, products and services, pricing, payment instructions, opening hours, booking settings, storefront links, team membership, operational preferences, and other information you choose to configure.

Customer, messaging, booking, and workflow data

When the Services are used for customer interactions, we may process WhatsApp or other messaging identifiers, names, messages, questions, leads, appointment requests, service requests, notes, booking status, payment-related submissions, customer support content, uploaded media, and conversation context needed to provide the requested workflow.

Prompts, files, model inputs, and outputs

AI and compute features may process prompts, documents, images, code, datasets, model inputs, model outputs, generated files, embeddings, logs, evaluation data, or other content submitted to or produced by the Services. The exact content depends on the product and workload you choose to run.

Integration data

If you connect a third-party service, we may receive identifiers, tokens, permissions, configuration data, and the data required to perform the integration you requested. This may include Google account information, Google Calendar event data, messaging platform data, payment-provider metadata, cloud infrastructure metadata, or similar integration data.

Payment, billing, and commercial data

We may process plan information, quotes, usage, metering records, credits, invoices, transaction references, payment status, billing contacts, tax-related information, and provider metadata. Payment card or mobile-money credentials may be collected directly by a payment provider rather than by ACF.

Technical, security, and usage data

We may collect IP address, device and browser information, operating system, page visits, timestamps, request and API logs, model or infrastructure routing metadata, performance metrics, error traces, session events, rate-limit events, billing counters, fraud signals, abuse indicators, and security events.

Support and communications data

We may collect emails, support requests, feedback, meeting or contact records, incident reports, and other communications you send to us.

Sensitive or special-category data

The Services are not designed to require sensitive personal data for ordinary use. However, users may submit content that contains health, financial, identification, biometric, confidential, or other sensitive information. Only submit such information when it is necessary, lawful, and appropriate for the selected Service. Where additional safeguards, consent, or restrictions are required, they apply.

3. Where Personal Data Comes From

We may receive personal data directly from you, from your organization, from customers or users interacting with a storefront or workflow, from connected integrations you authorize, from service providers supporting the Services, from payment or identity providers, from security and operational systems, or from publicly available sources where lawful and relevant.

4. Why We Process Personal Data and Our Legal Bases

We process personal data only where we have a valid purpose and, where applicable, a lawful basis. Depending on the jurisdiction and context, these may include:

Performance of a contract: to create and administer accounts, provide compute and AI services, execute requested workflows, manage bookings, provide APIs, process usage, bill for Services, and deliver support.
Legitimate interests: to secure the Services, prevent abuse and fraud, troubleshoot failures, measure reliability, improve product usability, manage capacity, understand service performance, and operate our business, where those interests are not overridden by applicable privacy rights.
Consent: where you choose to connect an integration, enable an optional feature, receive certain communications, or where applicable law requires consent for a particular processing activity.
Legal obligations: to maintain records, respond to lawful requests, comply with tax, accounting, regulatory, sanctions, anti-fraud, or other legal requirements, and establish or defend legal claims.

Where we rely on consent, you may withdraw it for future processing, subject to legal and technical limits. Withdrawal does not make earlier lawful processing unlawful.

5. AI, Model, and Automated Processing

Some Services use machine learning or AI systems to generate text or other outputs, classify or route requests, extract information, summarize content, assist with search, recommend actions, automate workflows, or operate compute infrastructure. Submitted content may be transmitted to model or infrastructure providers when that is necessary for the selected Service.

Where permitted by applicable law and applicable settings or agreements, we may use eligible data and feedback to develop, evaluate, improve, or train AI models and related systems. Eligible sources may include data we own or generate, public or licensed data, synthetic data, feedback, and service data that may lawfully be used for those purposes. Service-specific restrictions, processor commitments, provider rules, and express no-training commitments control where they apply.

Data received from integrations remains subject to applicable provider terms and restrictions. In particular, Google user data is handled in accordance with the Google API Services User Data Policy and Limited Use requirements and is not repurposed for generalized model training where those rules prohibit that use.

AI outputs can be wrong, incomplete, biased, or unsuitable for a particular purpose. Customers remain responsible for reviewing outputs before using them for legal, medical, employment, credit, financial, safety-critical, or similarly high-impact decisions.

Where a feature uses automated decision-making that is subject to specific legal rights, we will provide any additional notice, explanation, review mechanism, or opt-out required by applicable law. We do not treat automated output as a substitute for legally required human judgment.

6. Google Account and Google Workspace Data

When you sign in with Google, we may receive basic account information such as your name, email address, profile identifier, and authentication information. If you connect Google Calendar or another supported Google service, we request only the permissions needed for the feature you choose to use.

For Calendar-enabled functionality, the Services may read or create relevant event information and may create, update, or cancel events on your behalf. Event data may include attendee information, requested service, date and time, status, references, and notes needed for the requested workflow.

We may store authorization tokens securely so the integration can continue to function until you disconnect it, revoke access, or the authorization expires. Disconnecting an integration stops future access through that connection, although records already created in your Google account remain subject to your Google settings and any lawful retention requirements that apply to our own records.

We do not sell Google user data, use it for advertising, or use it for unrelated profiling. We limit access, use, and transfer of Google user data to providing or improving the user-facing features you authorized, security and abuse prevention, legal compliance, and other uses permitted by Google's policies.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Messaging and Communications Services

The Services may use third-party messaging or communications providers to help businesses communicate with customers. We may process message content and metadata to provide requested communications, support, bookings, transactions, and related workflows.

Businesses using messaging features are responsible for obtaining any permissions required for their communications, honoring opt-outs, using customer data lawfully, and complying with platform rules and applicable marketing or communications law.

8. Payments and Financial Information

Payment providers may process payment instruments directly under their own terms and privacy policies. We may receive transaction references, payment status, payer or merchant identifiers, amount, currency, fraud signals, and related metadata needed for reconciliation, access control, billing, refunds, disputes, or support.

Do not submit card numbers, PINs, passwords, recovery phrases, or other authentication secrets through general chat, prompt, or support fields unless the Service explicitly provides a secure field designed for that information.

9. How We Disclose Personal Data

We may disclose personal data only as reasonably necessary for the purposes described in this Policy, including to:

Infrastructure and service providers supporting hosting, compute, AI inference, storage, authentication, analytics, monitoring, messaging, email, support, logging, security, and other operational functions.
Payment and financial providers when needed to process, verify, reconcile, or dispute transactions.
Your organization and authorized users where your account belongs to a team, employer, customer, or managed organization.
Integration providers you choose when you connect or invoke their services.
Businesses and their customers where disclosure is necessary to complete a requested commercial, support, communications, or service workflow.
Professional advisers, auditors, insurers, or transaction counterparties where reasonably necessary and subject to appropriate confidentiality or legal safeguards.
Government authorities, courts, regulators, or other parties where required by law, valid legal process, protection of rights, prevention of fraud or abuse, or protection of safety.
A successor or transaction party in connection with a merger, financing, acquisition, restructuring, insolvency, or sale of assets, subject to applicable law.

10. Sale of Personal Data and Advertising

We do not sell personal data for money. We do not use Google user data for advertising. We do not currently operate the Services as a cross-context behavioral advertising network. If a future feature materially changes these practices, we will update the relevant notice and provide any legally required choices before that change applies.

11. International Data Transfers

ACF is based in Kenya, while some customers, users, infrastructure, and service providers may be located in other countries. Personal data may therefore be processed outside the country where it was collected.

When applicable law requires safeguards for international transfers, we use an available lawful mechanism appropriate to the transfer, which may include contractual safeguards, adequacy mechanisms, approved transfer instruments, provider commitments, or explicit consent where legally valid. We do not treat a foreign transfer as automatically lawful merely because a service provider is globally available.

12. Data Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the Services, maintain security and auditability, satisfy legal or accounting obligations, resolve disputes, and enforce agreements.

Retention periods vary by data category and product. In general, account and configuration data may be kept while an account is active and for a reasonable period afterward; transaction and billing records may be kept for legally required record-keeping periods; security and operational logs may be retained for fraud, reliability, or incident investigation; customer content may remain until deletion, account closure, expiry, or another service-specific retention event; and backups may persist for a limited period until they rotate out under normal backup schedules.

Where we process data solely on behalf of a customer, retention and deletion may also be governed by that customer's instructions and contract.

Training datasets, evaluation records, and models may have separate retention lifecycles where their use was lawful and authorized. Deleting source content does not necessarily require us to retrain or reverse a model already lawfully trained, except where applicable law or an agreement requires otherwise.

13. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or misuse. Measures may include access controls, authentication, encryption in transit or at rest where appropriate, secrets management, logging, least-privilege controls, environment separation, backups, incident response, and provider security controls.

No service can guarantee absolute security. You are responsible for protecting your own credentials, devices, API keys, recovery methods, and access permissions, and for notifying us promptly if you suspect unauthorized access.

14. Your Privacy Rights

Your rights depend on where you live and on our role in processing the relevant data. Subject to applicable law and permitted exceptions, you may have the right to:

be informed about how your personal data is used;
request access to personal data we hold about you;
request correction of inaccurate or misleading data;
request deletion or erasure of certain data;
object to or restrict certain processing;
withdraw consent where processing is based on consent;
receive certain data in a portable format where the law provides that right;
object to certain direct marketing or legally regulated profiling;
request information or review regarding certain automated decisions where applicable; and
complain to a competent data protection authority.

Kenyan data subjects have rights recognized by the Data Protection Act, including rights to be informed, access, object, correct false or misleading data, and seek deletion in circumstances provided by law.

15. How to Exercise Your Rights

To make a privacy request, email intro@africacomputefund.com and describe the account, product, organization, and request clearly enough for us to identify the relevant data. We may need to verify your identity or authority before completing a request.

We will respond within the period required by applicable law. Some requests may be limited where retention is required for legal obligations, security, fraud prevention, dispute resolution, the rights of other people, or other lawful exceptions.

If we process your data only on behalf of one of our customers, we may direct the request to that customer and assist them as required. If you are in Kenya and remain dissatisfied with our handling of a privacy matter, you may also contact the Office of the Data Protection Commissioner at odpc.go.ke.

16. Cookies, Local Storage, and Similar Technologies

Our websites and applications may use cookies, local storage, session storage, device identifiers, or similar technologies for authentication, security, preferences, service continuity, analytics, performance, and fraud prevention. Where applicable law requires consent for non-essential technologies, we will request it before using them.

17. Children

The Services are primarily intended for businesses and adults and are not directed to children under 18. We do not knowingly seek to collect children's personal data for ordinary use of the Services. If you believe a child has provided personal data without appropriate authorization, contact us so we can review the situation and take appropriate action.

18. Business Transfers and Organizational Changes

If ACF undergoes a financing, merger, acquisition, reorganization, insolvency process, or sale of all or part of its business or assets, information may be disclosed to advisers and relevant counterparties and may transfer as part of that transaction, subject to applicable law and appropriate safeguards.

19. Changes to This Policy

We may update this Policy to reflect changes in the Services, law, providers, or our data practices. We will post the revised version with an updated effective date. If a change materially affects how we use personal data, we will provide additional notice or obtain consent where required before applying the new practice.

20. Contact

Africa Compute Fund
Kenya
Email: intro@africacomputefund.com

For service support, billing, security, or privacy matters, include enough context for us to route your request to the correct team without including unnecessary sensitive information.